trufflehog

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

zeek-plugin-roca

Johanna::ROCA This plugin implements detection of CVE-2017-15361 keys; it is a reimplementation of the source available at https://github.com/crocs-muni/roca. This plugin provides two new BIFs that can check public keys: rocavulnerablecert checks if a certificate is vulnerable rocavulnerablemod...

CVE-2020-0688

CVE-2020-0688 Microsoft Exchange Server Fixed Cryptographic Key Remote Code Execution RCE Instead of having randomly-generated keys on a per-installation basis, all installations of Microsoft Exchange Server have the same validationKey and decryptionKey values in web.config. Thus, an authenticate...

Arisu

Arisu — AI Key Automated Mining System Arisu is a tool that automatically scans public code repositories GitHub, GitLab, Gitee, Docker Hub, PyPI, npm, etc. and code snippets Gist, Issues, CommonCrawl, extracts AI service API keys DeepSeek, OpenAI, Anthropic, Kimi, etc., and verifies their validit...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

rtx-cve-2023-45779

This repository is provided AS IS to accompanya Meta Red Team X vulnerability disclosure. It is not an official Meta project and will not be supported like one. A set of scripts and artifacts that demonstrate detection and exploitation of Android devices that ship APEXes signed with test keys fro...

Huan

Huan Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First,...

DumpTheGit

DumpTheGit DumpTheGit searches through public repositories to find sensitive information uploaded to the Github repositories. The tool will flag the matches for potentially sensitive files like credentials, secret keys, tokens etc which have been accidentally uploaded by the developers. DumpTheGi...

viewstate-security-workshop

Viewstate Security Workshop This repository is for the Testing ASP.NET ViewState with YSoNet YSoSerial.NET workshop. Recommended Reading: Exploiting Deserialisation in ASP.NET via ViewState Recommended Tools For Solving The Labs when lab has been setup: https://github.com/irsdl/crapsecrets...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

CVE-2023-34039

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight Static SSH key RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ Summary VMWa...

Blacklist3r

Blacklist3r The goal of this project is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage ...

XPKeygen

XPKeygen A Windows XP / Windows Server 2003 VLK key generator. This tool allows you to generate valid Windows XP keys based on the Raw Product Key , which can be random. The Raw Product Key RPK is supplied in form of 9 digits XXX-YYYYYY and is only necessary to generate a Windows XP Key. Download...

agent-vault-proxy

Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

hashcat

hashcat hashcat is a highly optimized password recovery platform for GPUs, CPUs, and large distributed systems. Features World's fastest password cracker World's first and only in-kernel rule engine, usable in every attack mode Free and open source, under the MIT license Multi-OS: Linux, Windows...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...